@tinycloud/share-sdk 1.3.0-beta.0 → 1.4.0-beta.0

package/dist/web-recipient.d.cts

@@ -1,3 +1,3 @@
-export { f as ShareMetadata, p as ShareRecipientClient, s as inspectShare } from './web-recipient-entry-D9IJEyRA.cjs';
+export { f as ShareMetadata, p as ShareRecipientClient, s as inspectShare } from './web-recipient-entry-CiUzdSQs.cjs';
 import '@tinycloud/share-envelope';
 import './authorization-CmP1skO8.cjs';

package/dist/web-recipient.d.ts

@@ -1,3 +1,3 @@
-export { f as ShareMetadata, p as ShareRecipientClient, s as inspectShare } from './web-recipient-entry-CKA_vCi5.js';
+export { f as ShareMetadata, p as ShareRecipientClient, s as inspectShare } from './web-recipient-entry-DVyTQBl0.js';
 import '@tinycloud/share-envelope';
 import './authorization-CmP1skO8.js';

package/dist/web-recipient.js

@@ -4921,7 +4921,8 @@ function isCanonicalRawCid(cidString) {
   } catch {
     return false;
   }
-  return cid.version === 1 && cid.code === code && cid.multihash.code === SHA256_CODE && cid.toString() === cidString;
+  return cid.version === 1 && cid.code === code && cid.multihash.code === SHA256_CODE && // `toString` of a parsed CID gives back the string it was parsed from; a fresh CID is encoded again.
+  CID.createV1(cid.code, cid.multihash).toString() === cidString;
 }
 var base64 = rfc4648({
   prefix: "m",
@@ -5378,51 +5379,7 @@ function validateV3Invariants(value, ctx) {
 var unsignedShareEnvelopeV3Schema = unsignedShareEnvelopeV3BaseSchema.superRefine(validateV3Invariants);
 var shareEnvelopeV3Schema = unsignedShareEnvelopeV3BaseSchema.extend({ signature: signatureSchema }).strict().superRefine(validateV3Invariants);
 var ENVELOPE_AAD_LABEL = "tinycloud-share-envelope-v1";
-var SEALED_BLOB_VERSION = 1;
 var AAD = utf8Bytes(ENVELOPE_AAD_LABEL);
-var KEY_LENGTH = 32;
-var NONCE_LENGTH = 12;
-var TAG_LENGTH = 16;
-var HEADER_LENGTH = 1;
-function assertKey(key32) {
-  if (key32.length !== KEY_LENGTH) {
-    throw new TypeError(`key must be ${KEY_LENGTH} bytes, got ${key32.length}`);
-  }
-}
-async function importAesKey(key32, usage) {
-  assertKey(key32);
-  return globalThis.crypto.subtle.importKey(
-    "raw",
-    key32,
-    "AES-GCM",
-    false,
-    [usage]
-  );
-}
-async function open(blob, key32) {
-  if (blob.length < HEADER_LENGTH + NONCE_LENGTH + TAG_LENGTH) {
-    throw new TypeError(`sealed blob too short: ${blob.length} bytes`);
-  }
-  if (blob[0] !== SEALED_BLOB_VERSION) {
-    throw new TypeError(`unknown sealed blob version: ${blob[0]}`);
-  }
-  const nonce = blob.subarray(HEADER_LENGTH, HEADER_LENGTH + NONCE_LENGTH);
-  const ciphertext = blob.subarray(HEADER_LENGTH + NONCE_LENGTH);
-  return decryptEnvelope(nonce, ciphertext, key32);
-}
-async function decryptEnvelope(nonce, ciphertext, key32) {
-  if (nonce.length !== NONCE_LENGTH) {
-    throw new TypeError(`nonce must be ${NONCE_LENGTH} bytes, got ${nonce.length}`);
-  }
-  const key = await importAesKey(key32, "decrypt");
-  return new Uint8Array(
-    await globalThis.crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: nonce, additionalData: AAD },
-      key,
-      ciphertext
-    )
-  );
-}
 function isPlainRecord(value) {
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
@@ -5654,56 +5611,6 @@ function base32Lower(bytes) {
   if (bits > 0) output += alphabet[buffer << 5 - bits & 31];
   return output;
 }
-var KEY_LENGTH2 = 32;
-var MAX_INLINE_BYTES = 256 * 1024;
-function assertCanonicalCid(cidString) {
-  const cid = CID.parse(cidString);
-  if (cid.version !== 1 || cid.code !== code || cid.multihash.code !== 18 || // sha2-256 (0x12) only, at the link layer too
-  cid.toString() !== cidString) {
-    throw new TypeError(`not a canonical CIDv1 raw sha2-256 base32 CID: ${cidString}`);
-  }
-}
-async function parseSealedInlineShareUrl(url, options = {}) {
-  const parsed = new URL(url);
-  if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "") throw new TypeError("sealed inline share URL must be canonical HTTPS without userinfo");
-  if (!isCanonicalHttpsOrigin(parsed.origin) || options.expectedOrigin !== void 0 && parsed.origin !== options.expectedOrigin) throw new TypeError("sealed inline share URL origin is not trusted");
-  if (parsed.pathname !== "/s/inline" || parsed.search !== "") throw new TypeError("not a Node sealed-inline share URL");
-  if (url !== `${parsed.origin}/s/inline${parsed.hash}`) throw new TypeError("sealed inline share URL is not lexically canonical");
-  const prefix = "#v=2&p=";
-  if (!parsed.hash.startsWith(prefix)) throw new TypeError("sealed inline URL is missing its canonical fragment");
-  const encoded = parsed.hash.slice(prefix.length);
-  if (encoded.length === 0 || parsed.hash !== `${prefix}${encoded}`) throw new TypeError("sealed inline URL fragment is not canonical");
-  let payloadBytes;
-  try {
-    payloadBytes = fromBase64Url(encoded);
-  } catch {
-    throw new TypeError("sealed inline payload is not canonical base64url");
-  }
-  if (payloadBytes.byteLength === 0 || payloadBytes.byteLength > MAX_INLINE_BYTES * 2) throw new TypeError("sealed inline payload is too large");
-  const payloadText = new TextDecoder("utf-8", { fatal: true }).decode(payloadBytes);
-  let value;
-  try {
-    value = JSON.parse(payloadText);
-  } catch {
-    throw new TypeError("sealed inline payload is not valid JSON");
-  }
-  if (typeof value !== "object" || value === null || Array.isArray(value) || canonicalize(value) !== payloadText) throw new TypeError("sealed inline payload is not canonical JSON");
-  const record = value;
-  if (Object.keys(record).length !== 4 || record.v !== 2 || typeof record.c !== "string" || typeof record.cid !== "string" || typeof record.k !== "string") throw new TypeError("sealed inline payload has invalid fields");
-  let ciphertext;
-  let key32;
-  try {
-    ciphertext = fromBase64Url(record.c);
-    key32 = fromBase64Url(record.k);
-  } catch {
-    throw new TypeError("sealed inline payload has invalid base64url material");
-  }
-  if (ciphertext.byteLength === 0 || ciphertext.byteLength > MAX_INLINE_BYTES) throw new TypeError("sealed inline ciphertext is outside the allowed size");
-  if (key32.byteLength !== KEY_LENGTH2) throw new TypeError("sealed inline key must be 32 bytes");
-  assertCanonicalCid(record.cid);
-  if (await computeCid(ciphertext) !== record.cid) throw new TypeError("sealed inline ciphertext does not match its CID");
-  return { kind: "inline", ciphertextCid: record.cid, ciphertext, key32 };
-}
 
 // src/artifact-core.ts
 var ARTIFACT_ROOT = "artifacts";
@@ -5818,26 +5725,80 @@ function metadataFor(envelope, origin) {
     ...envelope.artifactPin === void 0 ? {} : { artifact: { id: envelope.artifactPin.artifactId, version: envelope.artifactPin.version } }
   };
 }
+function receiveErrorFor(error) {
+  switch (error.code) {
+    case "origin_not_trusted":
+      return new ShareReceiveError("origin-mismatch", "share link origin is not trusted");
+    case "body_over_cap":
+    case "response_too_large":
+      return new ShareReceiveError("max-bytes-exceeded", "sealed policy envelope exceeds the size limit");
+    case "body_hash_mismatch":
+    case "link_cid_mismatch":
+      return new ShareReceiveError("cid-mismatch", "sealed envelope bytes do not match the link CID");
+    case "body_open_failed":
+      return new ShareReceiveError("decrypt-failed", "share envelope could not be opened");
+    case "gone":
+    case "expired":
+      return new ShareReceiveError("expired", "share link has expired, was deleted, or never existed");
+    case "bad_signature":
+    case "issuer_binding_mismatch":
+      return new ShareReceiveError("signature-invalid", "share link signature is invalid");
+    case "service_refused":
+    case "service_unavailable":
+    case "invalid_response":
+      return new ShareReceiveError("fetch-failed", "share link could not be fetched");
+    case "not_a_url":
+    case "not_https":
+    case "userinfo":
+    case "not_canonical":
+    case "query_present":
+    case "removed_version":
+    case "path_grammar":
+    case "fragment_grammar":
+    case "key_noncanonical":
+    case "cid_grammar":
+    case "record_encoding":
+    case "record_json":
+    case "record_not_canonical":
+    case "type_path_mismatch":
+    case "full_non_share":
+      return new ShareReceiveError("invalid-link", "share link format is invalid");
+    default:
+      return new ShareReceiveError("envelope-invalid", "share envelope is invalid");
+  }
+}
 async function resolvePolicyShare(link, options) {
   options.signal?.throwIfAborted();
   let url;
-  let parsed;
   try {
     url = new URL(link);
-    parsed = await parseSealedInlineShareUrl(link, { ...options.expectedOrigin === void 0 ? {} : { expectedOrigin: options.expectedOrigin } });
   } catch {
     throw new ShareReceiveError("invalid-link", "share link format is invalid");
   }
+  const links = await import("@tinycloud/share-envelope/links");
+  let resolved;
+  try {
+    resolved = await links.resolveLink(link, {
+      trustedOrigins: [options.expectedOrigin ?? url.origin],
+      apiOrigin: options.apiOrigin ?? links.DEFAULT_LINKS_API_ORIGIN,
+      ...options.fetch === void 0 ? {} : { fetch: options.fetch },
+      ...options.signal === void 0 ? {} : { signal: options.signal },
+      now: options.now?.() ?? Date.now()
+    });
+  } catch (error) {
+    options.signal?.throwIfAborted();
+    throw error instanceof links.LinkError ? receiveErrorFor(error) : error;
+  }
+  if (resolved.type !== "share") throw new ShareReceiveError("invalid-link", "share link is not a share");
   const limit = options.maxSealedBlobBytes ?? DEFAULT_MAX_SEALED_BLOB_BYTES;
-  if (!Number.isSafeInteger(limit) || limit <= 0 || parsed.ciphertext.byteLength > limit) throw new ShareReceiveError("max-bytes-exceeded", "sealed policy envelope exceeds the configured byte limit");
-  if (await computeCid(parsed.ciphertext) !== parsed.ciphertextCid) throw new ShareReceiveError("cid-mismatch", "sealed envelope bytes do not match the link CID");
+  if (!Number.isSafeInteger(limit) || limit <= 0 || resolved.body.byteLength > limit) throw new ShareReceiveError("max-bytes-exceeded", "sealed policy envelope exceeds the configured byte limit");
+  const cid = resolved.header.bodyCid;
   options.signal?.throwIfAborted();
   let envelope;
   try {
-    const encoded = new TextDecoder("utf-8", { fatal: true }).decode(await open(parsed.ciphertext, parsed.key32));
-    const value = JSON.parse(encoded);
-    if (canonicalize(value) !== encoded) throw new Error("non-canonical envelope");
-    envelope = shareEnvelopeV3Schema.parse(value);
+    const encoded = new TextDecoder("utf-8", { fatal: true }).decode(resolved.plaintext);
+    if (canonicalize(resolved.value) !== encoded) throw new Error("non-canonical envelope");
+    envelope = shareEnvelopeV3Schema.parse(resolved.value);
   } catch {
     throw new ShareReceiveError("envelope-invalid", "share envelope is invalid");
   }
@@ -5856,8 +5817,8 @@ async function resolvePolicyShare(link, options) {
   const expiry = Date.parse(envelope.expiry);
   if (!Number.isFinite(expiry)) throw new ShareReceiveError("envelope-invalid", "share expiry is invalid");
   if (expiry <= (options.now?.() ?? Date.now())) throw new ShareReceiveError("expired", "share has expired", { expiresAt: envelope.expiry });
-  options.onResolvedAddressedEnvelope?.(envelope, parsed.ciphertextCid);
-  return { envelope, origin: url.origin, cid: parsed.ciphertextCid };
+  options.onResolvedAddressedEnvelope?.(envelope, cid);
+  return { envelope, origin: url.origin, cid };
 }
 async function inspectShare(link, options = {}) {
   const resolved = await resolvePolicyShare(link, options);